Sandboxing
Running code in a heavily constrained environment where it can reach only what it absolutely must. The starting assumption is that the code will be compromised — the question is only how much is lost when it is.
The browser is the clearest example: each tab runs in its own process with no filesystem access and no right to talk to the network directly, and every such request goes through a controlling parent process. On Linux sandboxes are built with seccomp-bpf, namespaces, cgroups and Landlock; macOS has App Sandbox with entitlement files, Windows has AppContainer. A step further sits gVisor, which puts its own kernel implementation between the application and the real kernel, and micro-VMs like Firecracker. Sandbox escape is a vulnerability class of its own and is therefore the highest-paying category in bug bounty programs.